CVE-2026-63459

Vendure is an open-source headless commerce platform. Prior to 3.6.5, RichTextDescriptionCell in packages/dashboard/src/lib/components/shared/table-cell/order-table-cell-components.tsx attempts to strip markup by assigning an administrator-controlled description to a live element's innerHTML and...

CVE-2026-63459

Vendure (open-source headless commerce platform) prior to 3.6.5 contains a stored XSS in its Admin Dashboard. The RichTextDescriptionCell component strips HTML by assigning an administrator-controlled description field to a live element's innerHTML and then reading textContent. This pattern still...